October 2026

Edit Objectives on Active Quests

What's New:

Admins can now add or remove objectives on a Quest that is already active, without archiving it and creating a new one.

• Objectives are editable when you edit an active Quest.
• Before you save, a confirmation step lists the objectives being added and/or removed.
• If your Quest uses the restricted language setting, you can also add or remove available languages on an active Quest.

Key Benefits:

• Keep training current without disrupting learners' progress or reporting history.
• Save time by updating a running Quest instead of rebuilding it.

How to Access:

Available now for all customers. Open an active Quest and select Edit. See What can I change on an active Quest? for details.

Limit Learners to One Language in Quests

What's New:

You can now configure a Quest so each learner completes it in a single language of their choice.

• A new Limit learners to one language setting is available in the Quest's Advanced settings.
• When enabled, learners choose one language when they start the Quest.
• Use it on its own, or together with Choose the languages for this quest to control which languages learners can pick from.
• This setting is fixed once the Quest is active, so choose it before you publish.

Key Benefits:

• Deliver a consistent learning experience across a team.
• Simplify completion tracking and reporting.

How to Access:

Available now for all customers. When creating a Quest, go to Advanced settings. See the Quests FAQs for more information.

New AI Objectives Section in Quest Creation

What's New:

AI training content now has its own dedicated section at the top of the objectives screen in Quest creation, organized into three areas:

• AI-Enabled Development – for developers building with AI coding assistants and copilots.
• AI Applications – for teams building applications powered by large language models (LLMs).
• Citizen AI – for non-technical team members using AI in their work.

Key Benefits:

• Find and assign AI content quickly, instead of searching across different objective types.
• Target AI training to the right audience in your organization.

How to Access:

Available now for all customers. Create or edit a Quest and go to the objectives screen. See the Help Center article for details.

AI Challenges in Quest Quizzes

What's New:

Quest Quizzes can now use AI Challenges, bringing our newest Code Review experience to the most-used part of Quest training.

• When a topic has an AI Challenge that isn't already used in the training portion, the Quiz now uses it in place of the legacy challenge.
• Learners pass the Quiz with a score of 4/6 or higher.
• If a topic has no additional AI Challenge, the Quiz continues to use the legacy challenge, so nothing changes for those topics.

Key Benefits:

• Learners practise with more realistic, up-to-date code review scenarios.
• Applies automatically to all Quests, including those already published.

How to Access:

Available now for all customers. No configuration is required.

Trust Agent: Repository Grouping

What's New:

You can now organize the repositories Trust Agent ingests (via commits, vulnerabilities or AI usage) into groups, and build a hierarchy of groups — for example, Product & Engineering → Core Platform → Identity & Access.

Setting up groups is quick:

1. Download your current repository structure as a JSON file.
2. Copy the AI prompt provided, and give it to your preferred AI assistant along with the JSON file and a description of your target group structure.
3. The assistant generates a new JSON file.
4. Upload the file to import your groups.

Key Benefits:

• Easily manage and navigate hundreds or thousands of repositories.
• Avoid hours of manual repository assignment.

How to Access:

Available now for all Trust Agent customers under Trust Agent Configuration > Repository Groupings. Filtering by repository group on the AI and Commit pages is coming soon.

Trust Agent: New Cycode Connector

What's New:

Trust Agent now connects directly to Cycode, so vulnerability data flows in automatically via API instead of requiring a manual export and upload. Imported data populates the Vulnerability Report and powers Adaptive Learning with vulnerability data.

Key Benefits:

• Remove the manual effort of exporting and uploading scanner results.
• Keep vulnerability insights and targeted training continuously up to date.

How to Access:

Available now for all customers. Go to Trust Agent Configuration > Vulnerability Signal > Import and authenticate with your Cycode Client ID and Client Secret.

Trust Agent AI: Drill-Downs into Contributors, Models and MCPs

What's New:

The Trust Agent AI Insights dashboard now supports drill-downs. Click an item and a side panel opens with more detail:

• Contributors – which AI models and repositories each user is working with.
• Models – usage of each model by user.
• Model Context Protocol (MCP) tools – which users are using which MCP servers and tools, and which repositories are receiving commits made using MCPs.

Key Benefits:

• Move from aggregate numbers to the detail behind them in a single click.
• Better understand how AI tools are being adopted across your teams and codebase.

How to Access:

Available now for customers with the Trust Agent AI dashboard enabled. Open the AI Insights dashboard and click any contributor, model or MCP item.

Cybermon Activities Export

What's New:

A new CSV export in the Cybermon report includes every Cybermon activity for all learners in your company, with the start and finish time of each activity.

Key Benefits:

Recognize and reward learners using your own criteria, such as:

• First to earn a weekly badge
• Fastest (elapsed time) to earn a weekly badge
• First to defeat a Cybermon Prime
• Fastest (elapsed time) to defeat a Cybermon Prime

How to Access:

Available now. In the Cybermon report, open the Export drop-down under the Learner Details section. See the Cybermon Report article for details.

SCIM Provisioning: Support for externalId

What's New:

SCIM (System for Cross-domain Identity Management) provisioning now supports the optional externalId attribute, so you can populate users with your own unique identifiers.

Key Benefits:

• Match users reliably across your systems, even when names or email addresses change.
• Prevent sync mismatches when an email address is updated in your identity provider (IdP).
• Reduce manual adjustments to keep user records aligned.

How to Access:

Available now for customers using SCIM provisioning. Map your identity provider's unique user identifier to the externalId attribute in your SCIM configuration.

New Citizen AI Topic: Access and Data Risks when Sharing AI Artifacts and Automations

What's New:

The first topic in our new Citizen AI – From Automations to Apps journey is now live. It helps business users understand the hidden data, access and supply-chain risks of sharing AI work — such as skills, instructions, generated apps and dashboards, or whole conversations. A shared skill or automation runs with the access and permissions of the person using it, so it can reach data its author never tested it against.

The topic includes:

• A guideline
• A video
• An interactive mission

Key Benefits:

• Equip non-technical staff to share and reuse AI automations safely.
• Address a fast-growing source of data exposure as AI tools spread across the business.

How to Access:

Available now in Quests, Learn and Explore under the Citizen AI – From Automations to Apps journey. In Quest creation, find it under Citizen AI in the AI objectives section. Included with the Citizen AI licence and in the existing catalogue for other licence tiers. More Citizen AI topics are coming soon, including Security Risks of Vibe-Coded Websites and Apps, How LLMs Work and Verifying and Fact-Checking AI Output.

PHP2Shell Walkthrough and Learner Homepage Spotlight

What's New:

Following the disclosure of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell) that can allow unauthenticated remote code execution, we've released:

• A PHP2Shell walkthrough in Explore that explains how the exploit works, with a simulated AI assistant guiding you through the low-level memory manipulation behind the attack.
• A blog post, Hell in a PHP2Shell: How AI has shrunk the patch window from days to hours.
• A new section on the Learner Homepage featuring both.

Key Benefits:

• Help developers understand a high-profile, real-world vulnerability quickly.
• Give AppSec teams timely, practical context on how AI is shrinking the patch window.

How to Access:

Available now for all learners from the Learner Homepage or in Explore.